DNS Spoofing / Cache Poisoning (DNS Cache Poisoning)
Why DNS Cache Poisoning Is Important
DNS cache poisoning can redirect thousands of users at once because it targets the resolver's shared cache. When a popular public resolver is poisoned, every user relying on that resolver gets the wrong IP address for the targeted domain. This makes it an efficient attack vector for phishing, malware distribution, and traffic interception.
The classic cache poisoning attack (described by Dan Kaminsky in 2008) exploits the fact that DNS queries use predictable transaction IDs and source ports. By flooding a resolver with forged responses, an attacker can race the legitimate response. Modern resolvers use random source ports and transaction IDs to make this harder, but the fundamental vulnerability remains without DNSSEC.
DNSSEC is the definitive defense against cache poisoning because it allows resolvers to cryptographically verify that DNS responses are authentic and untampered. Without DNSSEC, resolvers must rely on source port randomization and response rate limiting, which raise the bar but do not eliminate the attack.
How to Verify
A DNS health checker verifies whether your domain has DNSSEC enabled, which protects against cache poisoning. It also checks that your nameservers implement source port randomization. For resolvers you control, verify they validate DNSSEC signatures.